Skip to main content
azd extensionsazd rest
azdrest

Commands

All HTTP method commands follow the same pattern: azd rest <method> <url> [flags]

CommandDescription
azd rest get <url>Execute a GET request
azd rest post <url>Execute a POST request
azd rest put <url>Execute a PUT request
azd rest patch <url>Execute a PATCH request
azd rest delete <url>Execute a DELETE request
azd rest head <url>Execute a HEAD request (headers only)
azd rest options <url>Execute an OPTIONS request
azd rest doctorDiagnose authentication and scope detection issues
azd rest graph <kql-query>Run an Azure Resource Graph (KQL) query
azd rest whoamiShow the authenticated Azure identity
azd rest scope <url>Preview the detected OAuth scope and auth mode for a URL
azd rest versionDisplay extension version

Global Flags

These flags are available for all HTTP method commands.

Authentication

FlagShortTypeDefaultDescription
--scope-sstring(auto)OAuth scope. Auto-detected for Azure services if not provided.
--no-authboolfalseSkip authentication. Use for public APIs.
--client-request-idstring""Set the x-ms-client-request-id header for Azure request correlation. Pass without a value to generate a random ID.

Request Configuration

FlagShortTypeDefaultDescription
--header-Hstring[][]Custom headers (repeatable). Format: Key:Value
--header-filestring""Read headers from a file (one Key: Value per line; blank lines and # comments ignored). -H overrides on conflict.
--url-paramstring[][]Set or append a URL query parameter (repeatable). Format: key=value
--data-dstring""Request body (JSON string)
--data-filestring""Read request body from file. Also accepts @file shorthand.
--data-formatstringjsonInterpret --data / --data-file as json or yaml before sending. With yaml, the body is converted to JSON and sent as application/json unless -H "Content-Type: ..." is set. Cannot be combined with --form-field, --json-field, or --json-field-raw.
--form-fieldstring[][]Add an application/x-www-form-urlencoded field (repeatable). Format: key=value. Repeat a key for multi-valued fields. Cannot be combined with --data or --data-file.
--json-fieldstring[][]Add a string field to a JSON request body (repeatable). Format: key=value. Dotted keys nest. Cannot be combined with --data, --data-file, or --form-field.
--json-field-rawstring[][]Add a raw JSON field to a JSON request body (repeatable). Format: key:=json. Dotted keys nest.
--timeout-tduration30sRequest timeout for a single attempt. Examples: 30s, 5m, 1h
--max-timeduration0Overall time budget across retries and pagination. 0 disables the limit.
--insecure-kboolfalseSkip TLS certificate verification

Response Configuration

FlagShortTypeDefaultDescription
--format-fstringautoOutput format: auto (pretty JSON), json (pretty JSON), raw, table, jsonl (one object per line), yaml, csv (RFC 4180)
--compact-cboolfalseMinify JSON output to a single line with no extra whitespace. Applies to auto and json formats and --query results. Non-JSON, binary, raw, table, jsonl, yaml, and csv are left unchanged.
--table-columnsstring""Comma-separated columns to show, in order, for --format table. Missing fields render as empty cells. Ignored for other formats.
--output-filestring""Write response to file
--raw-output-rboolfalseWith --query, print a string result unquoted and an array of strings one per line, like jq -r. Requires --query.
--redactstring[][]Mask a JSON response field before output (repeatable). Dotted path, * matches array elements. Applies to json, auto, table, and jsonl.
--redact-secretsboolfalseMask any JSON field whose name looks sensitive (password, secret, connectionString, accountKey, sasToken, and similar) at any depth. Runs alongside --redact and needs parsed JSON.
--flattenboolfalseFlatten a JSON response into a single-level object keyed by dotted paths (properties.provisioningState, value[0].name). Leaf values keep their type. Applies to the json and auto output paths and composes with --query.
--dump-headersstring""Write response status line and headers to a file (use - for stderr). Sensitive values are redacted.
--binaryboolfalseStream as binary without transformation
--verbose-vboolfalseShow headers, timing, request details (tokens redacted)
--colorstringautoColorize JSON output: auto (TTY only, honors NO_COLOR), always, never
--write-out-wstring""Print curl-style response metadata to stderr. See Write-Out Variables.

Advanced Options

FlagTypeDefaultDescription
--paginateboolfalseFollow continuation tokens / next links
--retryint3Retry attempts with exponential backoff for transient errors
--follow-redirectsbooltrueFollow HTTP redirects
--max-redirectsint10Maximum redirect hops
--show-throttleboolfalsePrint Azure rate-limit and quota headers (x-ms-ratelimit-remaining-*) to stderr, with a warning when remaining quota is low
--repeatint1Send the request N times and print latency stats (min/mean/p50/p95/p99/max) to stderr; only the last response body goes to stdout
--allow-hoststring[][]Restrict requests to hosts matching a pattern (repeatable; leading *. matches subdomains). Env: AZD_REST_ALLOWED_HOSTS (comma separated)
--failboolfalseExit with code 22 when the response status is 400 or higher. The response body is still printed, so error details stay visible.

Write-Out Variables

--write-out / -w prints a curl-style template to stderr after the request completes, so stdout stays clean for the response body. Use it in scripts and CI to capture the status code, timing, or size without parsing verbose output. The escape sequences \n and \t expand to newline and tab. Unknown%{...} tokens are left as-is.

VariableDescription
%{http_code}Response status code (e.g. 200)
%{http_status}Full status line (e.g. 200 OK)
%{time_total}Total request time in seconds
%{time_total_ms}Total request time in milliseconds
%{size_download}Response body size in bytes
%{content_type}Response Content-Type
%{method}Request method
%{url}Final request URL
%{header.NAME}Named response header value (sensitive headers redacted)
Terminal window
# Print only the status code
azd rest get https://management.azure.com/subscriptions?api-version=2020-01-01 \
--write-out "%{http_code}\n" > body.json
# Status and timing on one line
azd rest get https://graph.microsoft.com/v1.0/me \
--write-out "%{http_code} %{time_total}s %{size_download}B\n"

Scope Command

Preview how azd rest would authenticate a request to a URL without sending it. The command reports the resolved authentication mode, the OAuth scope, and the matched Azure service when known. It makes no network call, and honors --scope, --no-auth, and -H headers.

Terminal window
# Preview the scope for a Management API URL
azd rest scope https://management.azure.com/subscriptions?api-version=2020-01-01
# See the effect of --no-auth
azd rest scope https://api.github.com/repos/Azure/azure-dev --no-auth
# Machine-readable output
azd rest scope https://graph.microsoft.com/v1.0/me --format json
FlagShortTypeDefaultDescription
--scope-sstring(auto)Override the OAuth scope reported for the URL
--no-authboolfalseReport the request as unauthenticated
--header-Hstring[][]Headers used to evaluate auth skip (repeatable)
--format-fstringautoOutput format: auto or json

Version Command

Terminal window
# Default output
azd rest version
# Quiet — version number only
azd rest version --quiet
# JSON output
azd rest version --format json
FlagShortTypeDefaultDescription
--quiet-qboolfalseDisplay only the version number
--format-fstringautoOutput format: auto or json

Scope Detection

azd rest automatically detects the correct OAuth scope based on the URL hostname. This eliminates the need to manually specify scopes for most Azure API calls.

Supported Azure Services

ServiceHostname PatternScope
Azure Management APImanagement.azure.comhttps://management.azure.com/.default
Microsoft Graphgraph.microsoft.comhttps://graph.microsoft.com/.default
Azure Key Vault*.vault.azure.nethttps://vault.azure.net/.default
Azure Storage*.blob.core.windows.net
*.queue.core.windows.net
*.table.core.windows.net
*.file.core.windows.net
*.dfs.core.windows.net
https://storage.azure.com/.default
Azure Container Registry*.azurecr.iohttps://containerregistry.azure.net/.default
Azure Cosmos DB*.documents.azure.comhttps://cosmos.azure.com/.default
Azure App Configuration*.azconfig.iohttps://azconfig.io/.default
Azure Batch*.batch.azure.comhttps://batch.core.windows.net/.default
Azure Database (PostgreSQL/MySQL)*.postgres.database.azure.com
*.mysql.database.azure.com
*.mariadb.database.azure.com
https://ossrdbms-aad.database.windows.net/.default
Azure SQL Database*.database.windows.nethttps://database.windows.net/.default
Azure Synapse*.dev.azuresynapse.nethttps://dev.azuresynapse.net/.default
Azure Data Lake*.azuredatalakestore.nethttps://datalake.azure.net/.default
Azure Media Services*.media.azure.nethttps://rest.media.azure.net/.default
Azure Log Analyticsapi.loganalytics.iohttps://api.loganalytics.io/.default
Azure DevOpsdev.azure.com
*.visualstudio.com
499b84ac-1321-427f-aa17-267ca6975798/.default
Azure Kusto*.kusto.windows.nethttps://{hostname}/.default
Azure Service Bus*.servicebus.windows.nethttps://servicebus.azure.net/.default
Azure Event Hubs*.servicebus.windows.nethttps://eventhubs.azure.net/.default

Custom Scopes

For services not in the auto-detection list, provide a scope manually:

Terminal window
azd rest get https://api.myservice.com/data --scope https://myservice.com/.default

Pagination

When --paginate is enabled, azd rest automatically follows continuation tokens from Azure APIs. It looks for:

  • nextLink in the JSON response body
  • @odata.nextLink in OData responses
  • Link HTTP headers with rel="next"
Terminal window
# Get all resources across all pages
azd rest get https://management.azure.com/subscriptions/{sub}/resources?api-version=2021-04-01 --paginate

Retry Configuration

azd rest automatically retries failed requests with exponential backoff for transient errors (5xx status codes, network errors).

Terminal window
# Default: 3 retries
azd rest get https://api.example.com/resource
# Custom retry count
azd rest get https://api.example.com/resource --retry 5
# Disable retries
azd rest get https://api.example.com/resource --retry 0

Exit Codes

CodeMeaning
0Success
1Request failed (network error, invalid response)
2Invalid arguments or configuration
22Response status was 400 or higher and --fail was set

Troubleshooting

Authentication Errors

Error: failed to get token: credential unavailable

Terminal window
# Ensure you're logged in to Azure
az login
# Or use service principal
export AZURE_CLIENT_ID="..."
export AZURE_CLIENT_SECRET="..."
export AZURE_TENANT_ID="..."

Scope Detection Issues

Error: Warning: Azure host detected but no scope found

Terminal window
# Manually specify scope
azd rest get https://management.azure.com/... --scope https://management.azure.com/.default

Network Errors

Error: timeout or connection refused

Terminal window
# Increase timeout
azd rest get https://api.example.com/resource --timeout 5m
# Check proxy settings
echo $HTTP_PROXY
echo $HTTPS_PROXY

Invalid JSON Response

Error: failed to format response: invalid JSON

Terminal window
# Use raw format to see actual response
azd rest get https://api.example.com/resource --format raw

More Resources